#Triliumnext/Trilium OpenID with Authentik

1 messages · Page 1 of 1 (latest)

regal valley
#

I'm trying to get authentik to handle authentication for application Triliumnext.
I'm stuck at the point when I enable the authentik–server and authentik–location code blocks in my nginx triliumnext.subdomain.conf , I receive a 500 internal error from nginx.
I believe the issue might be with my authentik outpost service, when I try to curl the authentik core docker port (9000), it appears the port is closed. I'd like to use my authentik core docker for my Outpost service.
I currently have authentik going through my nginx with a valid TLS cert and it's working for my other apps as openID .

regal valley
#

Can someone confirm if I have to stand up another docker to act as an Authentik Outpost?
I have an authentik Embedded Outpost already created, but I cannot seem to curl to it via HTTPS on 9443 or 9000.
I trying to setup NGNIX authentik-server.conf parameters...

patent halo
#

you have nginx pointing to the authentic outpost (port 9443 or 9000), and authentik pointing to the actual triliumnext instance, and the application added to the outpost, correct?

#

and it works if you point nginx directly to trilium?

regal valley
regal valley
#

After some research, I went ahead and created a new Outpost (no embedded) and built a new docker for a Proxy Outpost following these steps:

1.) Create the Outpost in Authentik Core
2) In the Authentik admin interface, navigate to "Outposts" and add a new Outpost (choose Proxy, LDAP, or the type you need).

  1. After creation, click "View Deployment Info" to get the required environment variables:
    AUTHENTIK_HOST
    AUTHENTIK_TOKEN
    AUTHENTIK_INSECURE (usually "false")

4)Set Up the Outpost Container on Unraid. Use Unraid's Docker interface to create a new container.

Image:
Proxy: ghcr.io/goauthentik/proxy

  1. Add the environment variables you obtained from step 1.

  2. Configure Networking
    To avoid IP conflicts and control the Outpost's IP, set your Outpost container to use a specific Unraid custom Docker network (e.g., br0, br0.40, or another VLAN you have configured).

  3. When creating the container, Unraid allows you to assign a static IP if using a br0.X network. Set this to an available IP in your chosen subnet. Ensure the network selected enables connectivity to both Authentik Core and the apps you'll protect through the Outpost.

  4. Set Ports
    Proxy Outpost:
    Expose and map: 9000:9000, 9443:9443
    Adjust port mappings in Unraid's Docker template form as required for your network.

  5. Start docker and then check logs and go back to Authentik Outpost screen and make sure health/status updates.

#

I can now curl successfully to the Proxy Outpost using:

curl -vk https://172.16.5.68:9443/outpost.goauthentik.io/

However it appears I still have issues with my NGINX authentik-server.conf configuration since I continue to get NGINX 500 internal server error when going to my Triliumnext URL...

#

When I remark out these two lines in my NGINX triliumnext.subdomain.conf file, all works fine w/o Authentik in the mix:

#include /config/nginx/authentik-server.conf; # For Authentik SSO
#include /config/nginx/authentik-location.conf;

regal valley
#

So I'm taking a different approach, instead of NGINX forwarding auth to Authentik Proxy Outpost, I enabled the native OpenID settings in Triliumnext and added the required docker container variables.
But after doing that I am getting weird behavior where it wants to use 'login with google', not sure where that is coming from.
Here is the Triliumnext Github issue on it, which I active in: https://github.com/orgs/TriliumNext/discussions/6258

GitHub
Setting up a new Trilium Instance - OIDC · TriliumNext · Discussi...

Hello! Looking into using Trilium and trying to setup the server. Setting up is a breeze, but I can't get OAuth/OIDC to work properly. My compose looks like this: trilium: extends: file: ../sha...

regal valley
#

Triliumnext/Trilium OpenID with Authentik

regal valley
#

Anyone here have an idea why this is happening?

regal valley
#

Update: these are my current Triliumnext docker variables:

/usr/src/app # env | grep OAUTH
TRILIUM_OAUTH_BASE_URL=https://authentik.mydomain.com/application/o/triliumnext/
TRILIUM_OAUTH_ISSUER_NAME=Authentik
TRILIUM_OAUTH_ISSUER=https://authentik.mydomain.com/application/o/triliumnext/
TRILIUM_OAUTH_ISSUER_ICON=<url to icon image>
TRILIUM_OAUTH_CLIENT_ID=xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
TRILIUM_OAUTH_CLIENT_SECRET=xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx

The Triliumnext login screen looks good, but the login button directs me to https://trilium.mydomain.com and then it redirects to accounts.google.com for some ODD reason.

Anyone have some ideas why its not going to Authentik?

image.png
regal valley